Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 20:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe
-
Size
536KB
-
MD5
1b851d5440da7e3d0de81d73a716e4b3
-
SHA1
504d97e406ed5e2138d0908cadae65098536796a
-
SHA256
9bc422226198b0cf93c7495a882e86fbbcfc62988de887bf2cef20e2efaa1104
-
SHA512
ec35a8ce225d947cceabd229efe31c606c94aad3349652d793f4e966c558893b347fbdbc3612e9395ac354ea38c572323a813c6de4e0f7f035c336c8c3160f23
-
SSDEEP
12288:wU5rCOTeiUpzn9AcwfFoAlvyQePWIZxVJ0ZT9:wUQOJUpznyFFoA9euIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4868 349D.tmp 1572 350A.tmp 432 3568.tmp 1072 35F4.tmp 3204 3652.tmp 1064 36B0.tmp 3044 370E.tmp 3736 375C.tmp 4200 37D9.tmp 4440 3836.tmp 2292 38C3.tmp 3624 3911.tmp 4144 396F.tmp 4684 39DC.tmp 1740 3A3A.tmp 1436 3AB7.tmp 4288 3B15.tmp 4564 3B63.tmp 3600 3BD0.tmp 2316 3C1E.tmp 5100 3C6D.tmp 4576 3D38.tmp 2956 3D95.tmp 1812 3E03.tmp 3648 3E61.tmp 3324 3EBE.tmp 4512 3F5B.tmp 4876 3FA9.tmp 2044 4006.tmp 4356 4074.tmp 3348 40D2.tmp 3468 418D.tmp 3344 41DB.tmp 2692 4229.tmp 4976 4287.tmp 2236 42D5.tmp 1152 4362.tmp 3436 43C0.tmp 2056 441D.tmp 2036 446B.tmp 4824 4508.tmp 2292 4556.tmp 3916 45A4.tmp 1280 4602.tmp 732 4650.tmp 640 46BD.tmp 2384 472B.tmp 3328 4779.tmp 2756 47E6.tmp 1404 4834.tmp 4688 4892.tmp 3600 48E0.tmp 4464 492E.tmp 2928 497C.tmp 2912 49CA.tmp 1828 4A19.tmp 3612 4A67.tmp 796 4AD4.tmp 5056 4B90.tmp 4956 4C0D.tmp 4916 4C8A.tmp 244 4D35.tmp 220 4E10.tmp 4552 4EAC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4868 3908 2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe 82 PID 3908 wrote to memory of 4868 3908 2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe 82 PID 3908 wrote to memory of 4868 3908 2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe 82 PID 4868 wrote to memory of 1572 4868 349D.tmp 83 PID 4868 wrote to memory of 1572 4868 349D.tmp 83 PID 4868 wrote to memory of 1572 4868 349D.tmp 83 PID 1572 wrote to memory of 432 1572 350A.tmp 84 PID 1572 wrote to memory of 432 1572 350A.tmp 84 PID 1572 wrote to memory of 432 1572 350A.tmp 84 PID 432 wrote to memory of 1072 432 3568.tmp 122 PID 432 wrote to memory of 1072 432 3568.tmp 122 PID 432 wrote to memory of 1072 432 3568.tmp 122 PID 1072 wrote to memory of 3204 1072 35F4.tmp 88 PID 1072 wrote to memory of 3204 1072 35F4.tmp 88 PID 1072 wrote to memory of 3204 1072 35F4.tmp 88 PID 3204 wrote to memory of 1064 3204 3652.tmp 89 PID 3204 wrote to memory of 1064 3204 3652.tmp 89 PID 3204 wrote to memory of 1064 3204 3652.tmp 89 PID 1064 wrote to memory of 3044 1064 36B0.tmp 91 PID 1064 wrote to memory of 3044 1064 36B0.tmp 91 PID 1064 wrote to memory of 3044 1064 36B0.tmp 91 PID 3044 wrote to memory of 3736 3044 370E.tmp 92 PID 3044 wrote to memory of 3736 3044 370E.tmp 92 PID 3044 wrote to memory of 3736 3044 370E.tmp 92 PID 3736 wrote to memory of 4200 3736 375C.tmp 93 PID 3736 wrote to memory of 4200 3736 375C.tmp 93 PID 3736 wrote to memory of 4200 3736 375C.tmp 93 PID 4200 wrote to memory of 4440 4200 37D9.tmp 94 PID 4200 wrote to memory of 4440 4200 37D9.tmp 94 PID 4200 wrote to memory of 4440 4200 37D9.tmp 94 PID 4440 wrote to memory of 2292 4440 3836.tmp 95 PID 4440 wrote to memory of 2292 4440 3836.tmp 95 PID 4440 wrote to memory of 2292 4440 3836.tmp 95 PID 2292 wrote to memory of 3624 2292 38C3.tmp 96 PID 2292 wrote to memory of 3624 2292 38C3.tmp 96 PID 2292 wrote to memory of 3624 2292 38C3.tmp 96 PID 3624 wrote to memory of 4144 3624 3911.tmp 97 PID 3624 wrote to memory of 4144 3624 3911.tmp 97 PID 3624 wrote to memory of 4144 3624 3911.tmp 97 PID 4144 wrote to memory of 4684 4144 396F.tmp 98 PID 4144 wrote to memory of 4684 4144 396F.tmp 98 PID 4144 wrote to memory of 4684 4144 396F.tmp 98 PID 4684 wrote to memory of 1740 4684 39DC.tmp 99 PID 4684 wrote to memory of 1740 4684 39DC.tmp 99 PID 4684 wrote to memory of 1740 4684 39DC.tmp 99 PID 1740 wrote to memory of 1436 1740 3A3A.tmp 100 PID 1740 wrote to memory of 1436 1740 3A3A.tmp 100 PID 1740 wrote to memory of 1436 1740 3A3A.tmp 100 PID 1436 wrote to memory of 4288 1436 3AB7.tmp 101 PID 1436 wrote to memory of 4288 1436 3AB7.tmp 101 PID 1436 wrote to memory of 4288 1436 3AB7.tmp 101 PID 4288 wrote to memory of 4564 4288 3B15.tmp 102 PID 4288 wrote to memory of 4564 4288 3B15.tmp 102 PID 4288 wrote to memory of 4564 4288 3B15.tmp 102 PID 4564 wrote to memory of 3600 4564 3B63.tmp 140 PID 4564 wrote to memory of 3600 4564 3B63.tmp 140 PID 4564 wrote to memory of 3600 4564 3B63.tmp 140 PID 3600 wrote to memory of 2316 3600 3BD0.tmp 104 PID 3600 wrote to memory of 2316 3600 3BD0.tmp 104 PID 3600 wrote to memory of 2316 3600 3BD0.tmp 104 PID 2316 wrote to memory of 5100 2316 3C1E.tmp 105 PID 2316 wrote to memory of 5100 2316 3C1E.tmp 105 PID 2316 wrote to memory of 5100 2316 3C1E.tmp 105 PID 5100 wrote to memory of 4576 5100 3C6D.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_1b851d5440da7e3d0de81d73a716e4b3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\3568.tmp"C:\Users\Admin\AppData\Local\Temp\3568.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\35F4.tmp"C:\Users\Admin\AppData\Local\Temp\35F4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3652.tmp"C:\Users\Admin\AppData\Local\Temp\3652.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\396F.tmp"C:\Users\Admin\AppData\Local\Temp\396F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\39DC.tmp"C:\Users\Admin\AppData\Local\Temp\39DC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A3A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"23⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"24⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"25⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3E61.tmp"C:\Users\Admin\AppData\Local\Temp\3E61.tmp"26⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"27⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"28⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"29⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"30⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"31⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"32⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"33⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"34⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"35⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"36⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"37⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"38⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"39⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"40⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"41⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"42⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"43⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"44⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"45⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"46⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"47⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"48⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"49⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"50⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"51⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"52⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"53⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"54⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"55⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"56⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"57⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"58⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"59⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"60⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"61⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"62⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"63⤵
- Executes dropped EXE
PID:244 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"64⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"65⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"66⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"67⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"68⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"69⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"70⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"71⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"72⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"73⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"74⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"75⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"76⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"77⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"78⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"79⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"80⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"81⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"82⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"83⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"84⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"85⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"86⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"87⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"88⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"89⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"90⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"91⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"92⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"93⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"94⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"95⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"96⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"97⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"98⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"99⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"100⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"101⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"102⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"103⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"104⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"105⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"106⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"107⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"108⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"110⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"111⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"112⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"113⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"114⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"115⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"116⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"117⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"119⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"120⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"121⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"122⤵PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-